A decades-old puzzle over where the NIST elliptic curve seeds came from has been solved, and the answer is far more mundane than the rumors. Anthropic said its internal research model, Claude, worked out that the seeds were generated by a standard random number generator seeded with a Unix timestamp. The work settles a question that cryptographers had been asking since the standards were published.
The curves at issue belong to ECDSA, which Anthropic describes as the most widely used elliptic curve cryptography standard. The National Institute of Standards and Technology adopted it in 2000 as part of the FIPS 186-2 Digital Signature Standard. That standard lists a set of curves at different sizes and security levels. For curves over prime and binary fields, the specifications included a “seed” value whose hash defines one coefficient of the curve. The NSA provided those seeds with no explanation or justification. The seed for the NIST P-256 curve, for example, arrived with no account of where it came from.
That gap fueled years of speculation. Writers Neal Koblitz and Alfred Menezes summarized the controversy in a paper titled “A Riddle Wrapped in an Enigma.” An amateur investigation followed, and a bounty was offered to anyone who could find the seeds' origins. The most popular theory held that Jerry Solinas, a longtime NSA employee, had generated the seeds by hashing a humorous passphrase. Solinas said in 2015 that he did not remember the details. He died in 2023, and other colleagues from the period did not respond to inquiries, so the question remained open.
Several Anthropic employees tried to chase down the passphrase and failed. That lead, it turned out, was wrong. In October 2026, a curious employee asked the internal research model whether it could figure out how the seeds were generated without being pointed toward the clue. Anthropic said Claude found the origins of the P-192, P-224, P-256, P-384 and P-521 seeds in under half an hour. None came from a hash. They were the output of the C library's lrand48 random number generator, seeded with a Unix timestamp.
Searching for the phrase had come up empty, so Claude tried a different approach. It guessed that the software used a pseudorandom number generator common in 1990s C libraries. Those generators are weak enough that their output can be recognized. Claude wrote a scanner that tested whether chunks of each published seed were consecutive outputs of such a generator. Along the way, it noticed that the top bits of some seeds were all zero. Anthropic said that pattern would occur by chance with a probability of about 1 in 5,810. The pattern matched lrand48, which returns only the top 31 bits of a 48-bit internal state. From there, Claude recovered the hidden bits and confirmed that the output matched the seeds.
The prime-curve seeds required more work because the generator's output was truncated. Anthropic said Claude used a lattice-reduction algorithm to recover the internal state from those partial bits. Five NIST prime-curve seeds and five more from the ANSI X9.62 standard shared the same bit pattern. Each recovered state regenerated all 160 bits of its seed. Anthropic said that could not happen by chance.
The timestamps themselves are revealing. Anthropic reported that the ten prime-curve initializations correspond to dates between May 1997 and April 1998. The four binary-curve initializations read as February 1984, but when doubled, they map to April 17, 1998, two weeks after the P-224 run. Anthropic said this suggests the program may have halved the clock value.
Anthropic was clear about what the discovery does not show. It is not a cryptographic break, a new attack, or a weakness in the ECDSA curves. The company said the findings make it less plausible that the curves were chosen to contain backdoors. The seeds were generated in a simple way that anyone can now reproduce.
The team also traced some of the base points, the fixed points that every ECDSA public key is derived from. Six curves, including P-192 and five ANSI X9.62 example curves, have base points that come from the random number generator in FreeLIP, a long-integer arithmetic package written by Arjen Lenstra. Early versions of Victor Shoup's NTL library included the same code. Anthropic said no NIST base point had been explained before. The base points for P-224, P-256, P-384 and P-521 do not fit the same recipe, and the team could not determine how they were selected.
Several questions remain. Anthropic said some viable curves were skipped during generation, and it does not know the criteria behind that choice or whether it was accidental. The team could not recover the seed for the fifth binary curve, B-163. It also does not know how the NIST base points or the binary curve base points were produced. Anthropic said it does not believe weakened curves were selected, because that would imply they are common and easy to find.
The work was conducted at Anthropic by John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini and Steve Weis. The company has published the code used to reproduce the seeds and selected base points. The $36,864 bounty will go to the Internet Security Research Group.
Este artículo fue escrito con la asistencia de IA.
News Factory APP - noticias agénticas para impulsar tu SEO y AEO.